Template Protection Cockpit

The template protection cockpit enables centralized maintenance of the following items:

  • Template protection scenario configuration

  • Template components

  • Template rules

  • Conflicts

Additionally, you can navigate to the technical administration of template protection.

You can implement a detailed authorization concept for segregation of concerns using the authorization object FB_TPPC.

Scenario Overview

Within the scenario overview, you can maintain global and local systems as well as allowlists.

Global System

Global systems include one to several template rules, which shall be checked and protected on the connected local systems.

If a global system exists, template rules can be created based on live locking.

A global system can also be a virtual, non-existent system. In that case, it is just a container for manual rule definitions.

Local System

A local system is always assigned to a global system and is checked according to the rules defined within the global system.

A local system may be part of multiple global systems, but a global system may also contain multiple local systems (m:n relationship between local and global systems).

If live locking should apply to local systems as well (because there is an additional localized landscape), a local system can also act as a global system in parallel.

Allowlist

You can add an allowlist to the global system. All entries created for the allowlist overrule the template rules, so that you can define that specific objects/template rules may never be protected, even though they were added as part of live locking or manual rule maintenance.

Template Components

A template component clusters template rules across global systems. This means that you can, for example, define a template component FICO and assign template rules of different global systems to that component.

Template Rules

A template rule contains an object or, if wildcards are used, a set of objects to be protected.

A template rule is always connected to one global system or to its corresponding allowlist.

Within the Template Protection cockpit, you can create, read, update and delete template rules.

Create Template Rules

You can manually create template rules using the Add Template Rule button, which opens the wizard.

Select Global System

It is mandatory to select the global system, for which new rules should be created

Select Template Component

Optionally, you can select a template component.

Select Scope

Template rules can be created for the global system itself, so that the objects are protected or for the corresponding allowlist to overrule all other template rules.

Select Source

Template rules can either be created from transport requests or via manual input.

Transport-Request-Based Scoping

The transport-request-based scoping shows all transport requests managed by Change Request Management for the global system. This means it works for existing global systems only.

After you have selected a transport request and confirmed the scoping, a template rule is created for every object of the transport request. They are bundled via the Source Type TR and the Transport Request Number as source.

Manual Selection

You can manually create template rules via direct input. The system differentiates between workbench and customizing objects, but both types can be scoped in a row.

Copy and paste, for example based on the same structure as in Microsoft Excel, works when you select the header of the table and press Ctrl + V . Due to restrictions within the SAP UI5 library, this is only supported for up to 100 entries.

Additional considerations when using the manual selection:

  • For workbench objects, you cannot scope LIMU objects (such as function modules). Those depend on a parent object (such as a function group), which is not known to SAP Solution Manager.

  • For customizing objects, it is important to maintain the key length of the database table, as this is not known to SAP Solution Manager.

    If no key length is maintained, a table key is considered as <table_key>*>, so that it also includes <table_key>_1>.

  • Especially when maintaining a lot of manual entries, it can be easier to prepare a specific transport request and use the transport-request-based scoping instead of scoping all objects manually.

Update Template Rules

You can change the template rules within the template protection cockpit using the buttons in the footer of the cockpit:

  • Edit Template Rule (single maintenance)

    You can change object-specific details of a template rule via the single maintenance. To do so, select an entry and open the edit mode. Beside the object-specific details, you can also change the local lock handling.

    The local lock handling gives the possibility to define how a rule should react on a specific local system. You can define a rule on local system A as a warning, even though the global configuration would see it as an error.

  • Selected Template Rules (mass change)

    If you select multiple template rules, the Selected Template Rules mass change allows you to apply certain changes to all selected rules:

    • Activate/Deactivate Rule

    • Ignore/Unignore Rule

    • Delete Rule

  • Filtered Template Rules (mass change)

    Via the Filtered Template Rules mass change, you an apply certain changes to all rules that are available based on the current filter. With that, not every single rule has to be selected, but the changes are applied to all relevant template rules:

    • Activate/Deactivate Rule

    • Ignore/Unignore Rule

    • Delete Rule

    • Maintain Local Lock Handling

Conflicts

Within the Conflicts tab, you can maintain template protection conflicts. A conflict describes a change to a protected object on a local system.

Conflicts are only possible in the conflict calculation mode warning, as an error during conflict calculation would not allow to save the change to a transport request.

You can update conflicts using the following settings:

  • Select Conflicts: Updates only selected conflicts

  • Filtered Conflicts: Updates all conflicts available for the current filter

You can set various statuses for a conflict:

  • Approved: The change is approved – release of the transport request is allowed

  • Rejected: The change is rejected – the object must be removed from the transport request to allow the release

  • Manually Resolved: The change is rejected, but it is not required to remove the object from the transport request. With this status, the user confirms that the change has been undone.

Administration

The Administration tab provides a direct link to the view cluster for the central customizing of template protection.